ANS-C01 Practice Test 8 — 10 Questions

Question 1

A network engineer is configuring AWS Client VPN for remote access. The engineer creates a Client VPN endpoint and associates it with a target network (subnet) in the VPC. After associating, clients can connect to the VPN but cannot access resources in the VPC. The security groups and network ACLs allow all traffic. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Client VPN endpoint's route table does not include a route to the VPC CIDR. The Client VPN endpoint's route table must include a route to the VPC CIDR for traffic from clients to reach VPC resources. Without this route, packets are not forwarded to the VPC. Option A is incorrect because the subnet association is properly done; the endpoint is associated with a subnet. Option B is incorrect because a client CIDR overlap would cause routing conflicts, but the question states clients can connect but cannot access resources, indicating the VPN tunnel is established. Option C is incorrect because authorization rules control access to specific networks (e.g., security groups), but if no route exists, traffic won't reach the VPC even with authorization rules.

Answer

The Client VPN endpoint is not associated with a subnet in the VPC

Answer

The client CIDR range overlaps with the VPC CIDR

Answer

The Client VPN endpoint does not have an authorization rule to allow access to the VPC CIDR

Question 2

A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?

Accepted Answer

Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.. Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.

Answer

Verify that the virtual private gateway is attached to the VPC.

Answer

Verify that the on-premises firewall is not blocking UDP port 500 for IKE.

Answer

Verify that the VPN tunnel's pre-shared key matches on both sides.

Question 3

A company is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, while the application and database servers must be isolated. Which subnet design should the company use?

Accepted Answer

Public subnet for web servers, private subnets for application and database servers. It uses a public subnet with an Internet Gateway (IGW) for the web servers to receive inbound traffic from the internet, while placing the application and database servers in private subnets with no direct internet route. This design enforces the principle of least privilege by isolating sensitive tiers, using NAT Gateway or VPC endpoints for outbound traffic if needed, and relying on security groups and network ACLs for fine-grained access control.

Answer

A single subnet for all tiers with network ACLs to isolate traffic

Answer

Private subnets for all tiers

Answer

Public subnets for all tiers

Question 4

A company is using AWS Direct Connect to connect its on-premises data center to AWS. The network team wants to monitor the latency and packet loss on the Direct Connect virtual interfaces. Which AWS service should be used to measure these metrics?

Accepted Answer

AWS CloudWatch. AWS CloudWatch is the correct service because it provides built-in metrics for Direct Connect virtual interfaces, including 'VirtualInterfaceRxNoPacket' and 'VirtualInterfaceTxNoPacket' for packet loss, and you can derive latency by monitoring the 'VirtualInterfaceBpsEgress' and 'VirtualInterfaceBpsIngress' metrics with appropriate alarms. CloudWatch also supports custom metrics and logs that can be used to calculate round-trip time (RTT) by analyzing ping results or using AWS Direct Connect's native health checks. This allows the network team to set up dashboards and alarms for latency and packet loss directly from the Direct Connect metrics.

Answer

AWS Config

Answer

AWS X-Ray

Answer

AWS CloudTrail

Question 5

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to peer with another VPC that has a CIDR block of 10.0.0.0/16. What should the network engineer do to enable connectivity between the two VPCs?

Accepted Answer

Use an AWS Transit Gateway with Network Address Translation (NAT) to resolve overlapping CIDRs.. When two VPCs have overlapping CIDR blocks (both 10.0.0.0/16), a standard VPC peering connection cannot be established due to route table conflicts. An AWS Transit Gateway can be used with Network Address Translation (NAT) to translate the overlapping IP addresses, enabling connectivity between the VPCs by allowing traffic to be routed through the Transit Gateway with NAT applied to resolve the address conflict.

Answer

Use an internet gateway to route traffic between the VPCs.

Answer

Create a VPC peering connection and add routes in both route tables.

Answer

Create a VPC peering connection and use a network address translation (NAT) device.

Question 6

A company has a global application deployed across multiple AWS Regions. Users are routed to the nearest Region using Amazon Route 53. The application uses an Application Load Balancer in each Region. The network team wants to ensure that traffic is always routed to a healthy Region in case of a Regional failure. Which Route 53 routing policy should be used?

Accepted Answer

Latency-based routing with health checks. Latency-based routing with health checks. This policy routes traffic to the region with the lowest latency and can automatically failover to a healthy region if health checks fail. Option B (Weighted routing) distributes traffic based on weights, not latency, and does not provide automatic failover based on health. Option C (Simple routing) routes to a single resource and cannot automatically failover. Option D (Failover routing) is a primary/backup setup, not latency-based, so it doesn't consider latency.

Answer

Weighted routing

Answer

Simple routing

Answer

Failover routing

Question 7

A network engineer is troubleshooting high latency between two EC2 instances in the same VPC but different Availability Zones. Which AWS service can provide detailed network performance metrics to identify the source of latency?

Accepted Answer

AWS X-Ray. Correct answer: C. AWS X-Ray provides end-to-end tracing and can capture network latency between services, including EC2 instances. It can help identify where delays occur. Option A (AWS Config) is incorrect because it monitors configuration changes, not performance. Option B (AWS CloudTrail) is incorrect because it records API calls for auditing, not network metrics. Option D (VPC Flow Logs) is incorrect because it captures IP traffic metadata (packet-level) but does not provide latency or performance metrics.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 8

A company has a Direct Connect connection with a public VIF to access AWS public services. The on-premises network team reports that they can reach S3 but not DynamoDB. The route table on the customer router shows a default route to the public VIF. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking outbound traffic to the DynamoDB IP ranges.. DynamoDB uses a different set of public IP ranges than S3, and the on-premises firewall might block access to those ranges. Option A is wrong because the Direct Connect connection is a single physical link; if it were degraded, it would affect all traffic, not just DynamoDB. Option B is wrong because the public VIF does use BGP, but the customer router has a default route to the public VIF, indicating the BGP session is established and routes are being received. Option D is wrong because the public VIF accesses AWS public services directly, not through the VPC route table.

Answer

The Direct Connect connection is degraded and only supports S3 traffic.

Answer

The BGP session between the customer router and AWS is down.

Answer

The VPC route table does not have a route to the DynamoDB endpoint.

Question 9

A company has a Direct Connect connection with a private VIF to a VPC. They want to add a second Direct Connect connection for redundancy. The two connections will terminate on different AWS Direct Connect locations. Which configuration will provide the HIGHEST availability?

Accepted Answer

Use different customer gateway devices and different Direct Connect locations. Using different customer gateway devices and different Direct Connect locations provides full physical diversity, eliminating single points of failure at both the device and location level. Option A introduces a single point of failure by using the same device. Option B uses the same location, reducing availability in case of location failure. Option C uses the same BGP ASN, which can cause routing issues but is not the primary concern for physical redundancy.

Answer

Use the same customer gateway device for both connections

Answer

Use the same Direct Connect location for both connections

Answer

Use the same BGP ASN for both connections

Question 10

A company has a VPC with public and private subnets. They have a NAT gateway in a public subnet for outbound internet access from private instances. Which TWO of the following are required for the NAT gateway to function correctly?

Accepted Answer

A route in the public subnet's route table to an internet gateway. A NAT gateway must be placed in a public subnet and requires an Elastic IP address (E) to enable outbound internet traffic with a source IP that can be routed back. Additionally, the public subnet where the NAT gateway resides must have a route in its route table that points to an internet gateway (C) for the NAT gateway to reach the internet. Security groups are not attached to NAT gateways (they use security groups for attached instances, but NAT gateways themselves are not security group–aware). Network ACLs control traffic at the subnet level but are not a requirement specific to NAT gateway functionality; they can be configured as needed. Deploying the NAT gateway in a private subnet (A) would prevent it from accessing the internet because private subnets do not have direct routes to an internet gateway. Therefore, only options C and E are required.

Answer

The NAT gateway is deployed in a private subnet

Answer

A security group attached to the NAT gateway

Answer

A network ACL attached to the NAT gateway's subnet that allows inbound traffic from the internet